@rubytech/create-maxy-code 0.1.219 → 0.1.221

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-base64-guard.test.sh

@@ -1,204 +0,0 @@
-#!/usr/bin/env bash
-# Regression test for the base64 context-overflow guard.
-#
-# Covers two PreToolUse rejection paths in pre-tool-use.sh:
-#
-#   1. Bash producer guard — `tool_input.command` invoking `base64` (encode
-#      direction) or `xxd -p` is rejected; `base64 -d|-D|--decode` is allowed.
-#   2. Write/Edit consumer guard — `tool_input.content` (Write) or
-#      `tool_input.new_string` (Edit) carrying `data:<mime>;base64,<≥4096 chars>`
-#      is rejected; small inline data URIs and plain content are allowed.
-#
-# Plus a fail-open case (malformed stdin → exit 0 silent) to pin the contract
-# established by the playwright-file-guard test (terminal-stdin guard + parse-
-# error fail-open).
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/pre-tool-use.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-TMPFILES=()
-cleanup_test_state() {
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup_test_state EXIT
-
-PASS=0
-FAIL=0
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-# Helper: run hook with Bash tool_input.command and assert exit code + stderr.
-run_bash() {
-  local command_text="$1"; local expected_rc="$2"; local stderr_pattern="$3"; local label="$4"
-  local input_json
-  # Build the input JSON via python3 so command_text with quotes / specials is safe.
-  input_json=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Bash", "tool_input": {"command": sys.argv[1]}, "transcript_path": "/tmp/sess/parent.jsonl", "parent_tool_use_id": "toolu_test_subagent"}, separators=(",", ":")))
-' "$command_text")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$stderr_pattern" ]] && ! grep -qE "$stderr_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$stderr_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# Helper: run hook with Write tool_input.content and assert exit code + stderr.
-run_write() {
-  local content="$1"; local expected_rc="$2"; local stderr_pattern="$3"; local label="$4"
-  local input_json
-  input_json=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Write", "tool_input": {"file_path": "/tmp/test.html", "content": sys.argv[1]}, "transcript_path": "/tmp/sess/parent.jsonl", "parent_tool_use_id": "toolu_test_subagent"}, separators=(",", ":")))
-' "$content")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$stderr_pattern" ]] && ! grep -qE "$stderr_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$stderr_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# Helper: run hook with Edit tool_input.new_string and assert exit code.
-run_edit() {
-  local new_string="$1"; local expected_rc="$2"; local stderr_pattern="$3"; local label="$4"
-  local input_json
-  input_json=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Edit", "tool_input": {"file_path": "/tmp/test.html", "old_string": "OLD", "new_string": sys.argv[1]}, "transcript_path": "/tmp/sess/parent.jsonl", "parent_tool_use_id": "toolu_test_subagent"}, separators=(",", ":")))
-' "$new_string")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$stderr_pattern" ]] && ! grep -qE "$stderr_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$stderr_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# Generate a base64-character blob >= 4096 chars (data-URI body trigger).
-LARGE_B64=$(python3 -c "print('A' * 5000)")
-
-# ───────── Bash producer guard ──────────────────────────────────────────────
-run_bash "echo hello world" 0 "" \
-  "Test 1: bare Bash command (no base64) allowed"
-
-run_bash "ls -la" 0 "" \
-  "Test 2: ls -la (no base64 token) allowed"
-
-run_bash "base64 /tmp/foo.png" 2 '\[pre-tool-use\] guard=base64-tool-result.*tool=Bash.*reason=base64-encoder.*action=reject' \
-  "Test 3: 'base64 file' (encode) rejected"
-
-run_bash "cat foo.png | base64" 2 '\[pre-tool-use\] guard=base64-tool-result.*action=reject' \
-  "Test 4: 'cat | base64' (encode pipeline) rejected"
-
-run_bash "cat foo.png|base64 -w0" 2 '\[pre-tool-use\] guard=base64-tool-result.*action=reject' \
-  "Test 5: 'base64 -w0' (encode with line-wrap flag) rejected"
-
-run_bash "xxd -p file.bin" 2 '\[pre-tool-use\] guard=base64-tool-result.*reason=xxd-plain-hex.*action=reject' \
-  "Test 6: 'xxd -p' (plain hex encode) rejected"
-
-run_bash "base64 -d input.b64 > output.bin" 0 "" \
-  "Test 7: 'base64 -d' (decode direction) allowed"
-
-run_bash "base64 --decode < x.b64 > y.bin" 0 "" \
-  "Test 8: 'base64 --decode' (decode long-form) allowed"
-
-run_bash "echo Zm9v | base64 -d" 0 "" \
-  "Test 9: 'base64 -d' decode pipeline allowed"
-
-run_bash "echo '--debug-base64-foo'" 0 "" \
-  "Test 10: 'base64' substring inside flag name does NOT false-match"
-
-run_bash "ls mybase64tool" 0 "" \
-  "Test 11: 'base64' substring inside identifier does NOT false-match"
-
-run_bash "cat in.b64 | base64 -d > /tmp/foo.bin; cat /tmp/bar.png | base64" 2 '\[pre-tool-use\] guard=base64-tool-result.*reason=base64-encoder.*action=reject' \
-  "Test 11b: compound (decode ; encode) rejects encoder segment (per-segment scan)"
-
-run_bash "echo data | base64 -d > x.bin && cat y.png | base64 > y.b64" 2 '\[pre-tool-use\] guard=base64-tool-result.*action=reject' \
-  "Test 11c: compound (decode && encode) rejects encoder segment"
-
-run_bash "base64 -d in.b64 > out.bin; base64 -d in2.b64 > out2.bin" 0 "" \
-  "Test 11d: compound (decode ; decode) allowed"
-
-# ───────── Write/Edit consumer guard ────────────────────────────────────────
-run_write "<html><body>hello world</body></html>" 0 "" \
-  "Test 12: Write small HTML content (no data URI) allowed"
-
-run_write "<img src='data:image/png;base64,AAAA'>" 0 "" \
-  "Test 13: Write content with small inline data URI (<4096 chars) allowed"
-
-run_write "<img src='data:image/png;base64,${LARGE_B64}'>" 2 '\[pre-tool-use\] guard=base64-write-content.*action=reject' \
-  "Test 14: Write content with large inline data URI (>4096 chars) rejected"
-
-run_edit "<img src='data:image/png;base64,${LARGE_B64}'>" 2 '\[pre-tool-use\] guard=base64-write-content.*action=reject' \
-  "Test 15: Edit new_string with large inline data URI rejected"
-
-run_edit "<p>just text replacement</p>" 0 "" \
-  "Test 16: Edit new_string with plain text allowed"
-
-# ───────── Fail-open / structural ───────────────────────────────────────────
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-printf '%s' 'not json at all { ' | bash "$HOOK" admin >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-if [[ "$RC" -ne 0 ]]; then
-  fail "Test 17: malformed stdin should fail open (exit 0), got $RC. Stderr: $(cat "$STDERR_FILE")"
-else
-  pass "Test 17: malformed stdin → silent passthrough (fail-open)"
-fi
-
-# Terminal-stdin guard preserved (no -t 0 test runs in test harness; assert
-# the guard line exists in source).
-if ! grep -q '\[ -t 0 \]' "$HOOK"; then
-  fail "Test 18: terminal stdin guard missing from hook source"
-else
-  pass "Test 18: terminal stdin guard present in source"
-fi
-
-# Pre-existing guards still active — entitlement file edit still rejected.
-ENT_JSON=$(python3 -c 'import json; print(json.dumps({"hook_event_name":"PreToolUse","tool_name":"Write","tool_input":{"file_path":"/srv/entitlement.json","content":"{\"tier\":\"max\"}"},"transcript_path":"/tmp/sess/parent.jsonl","parent_tool_use_id":"toolu_test_subagent"}, separators=(",", ":")))')
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-printf '%s' "$ENT_JSON" | bash "$HOOK" admin >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-if [[ "$RC" -ne 2 ]]; then
-  fail "Test 19: pre-existing entitlement guard regressed (expected exit 2, got $RC)"
-else
-  pass "Test 19: pre-existing entitlement guard still rejects entitlement.json"
-fi
-
-echo
-echo "──────── pre-tool-use base64 guard test summary ────────"
-echo "PASS: $PASS"
-echo "FAIL: $FAIL"
-
-[[ "$FAIL" -gt 0 ]] && exit 1
-exit 0

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-memory-write-passthrough.test.sh

@@ -1,118 +0,0 @@
-#!/usr/bin/env bash
-# Task 225 — passthrough regression test for memory-write / memory-update
-# under the admin agent's pre-tool-use.sh.
-#
-# The Task 213→222 chain previously gated both writers at the top of the
-# admin branch with an exit-2 block (admin direct) and an exit-0 allow
-# (Task-subagent). Task 225 reversed the doctrine: admin holds the
-# writers in its own surface and the case-block was deleted. This test
-# pins the new behaviour so a future re-introduction of the block
-# cannot land silently.
-#
-# Five cases:
-#   1. mcp__plugin_memory_memory__memory-write     admin-direct → exit 0, no rejection stderr
-#   2. mcp__plugin_memory_memory__memory-update    admin-direct → exit 0, no rejection stderr
-#   3. mcp__plugin_memory_memory__memory-search    admin-direct → exit 0, no rejection stderr (read tool control)
-#   4. mcp__memory__memory-write                   admin-direct → exit 0 (pre-209 namespace, falls through harmlessly)
-#   5. malformed JSON stdin                                   → exit 0 (no crash; case-block removal does not break fall-through)
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/pre-tool-use.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-TMPFILES=()
-cleanup() {
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup EXIT
-
-PASS=0
-FAIL=0
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-# Admin-direct calls land with a non-subagent transcript path. A synthetic
-# empty file in a temp dir is enough — the hook no longer reads the path
-# for the deleted writers' case-block, but other gates may still touch it.
-ADMIN_TRANSCRIPT=$(mktemp); TMPFILES+=("$ADMIN_TRANSCRIPT")
-: > "$ADMIN_TRANSCRIPT"
-
-run_with_tool() {
-  local tool="$1"
-  local sid="$2"
-  local transcript_path="${3:-}"
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  python3 -c '
-import json, sys
-payload = {
-  "hook_event_name": "PreToolUse",
-  "session_id": sys.argv[1],
-  "tool_name": sys.argv[2],
-  "tool_input": {"name":"Smalleys","accountId":"acct-x","scope":"shared"},
-}
-if sys.argv[3]:
-  payload["transcript_path"] = sys.argv[3]
-print(json.dumps(payload, separators=(",", ":")))
-' "$sid" "$tool" "$transcript_path" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  HOOK_RC=$?
-  HOOK_STDERR=$(cat "$stderr_file")
-}
-
-assert_passthrough() {
-  local label="$1"
-  if [[ "$HOOK_RC" -ne 0 ]]; then
-    fail "${label}: expected exit 0, got $HOOK_RC stderr: $HOOK_STDERR"
-    return
-  fi
-  if echo "$HOOK_STDERR" | grep -qF "does not write to the graph directly"; then
-    fail "${label}: stderr carries deleted-block rejection message: $HOOK_STDERR"
-    return
-  fi
-  pass "${label}: exit 0, no rejection stderr"
-}
-
-# --- 1. memory-write admin-direct passthrough ---------------------------
-run_with_tool "mcp__plugin_memory_memory__memory-write" "sess-write-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "admin-direct memory-write"
-
-# --- 2. memory-update admin-direct passthrough --------------------------
-run_with_tool "mcp__plugin_memory_memory__memory-update" "sess-update-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "admin-direct memory-update"
-
-# --- 3. memory-search admin-direct passthrough (read tool control) -----
-run_with_tool "mcp__plugin_memory_memory__memory-search" "sess-search-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "admin-direct memory-search (read tool control)"
-
-# --- 4. pre-209 namespace mcp__memory__memory-write ---------------------
-# The bare mcp__memory__ namespace was never in the admin runtime surface
-# after Task 203's plugin_ prefix rename; this case pins that it still
-# falls through harmlessly after the case-block removal.
-run_with_tool "mcp__memory__memory-write" "sess-old-ns-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "pre-209 namespace mcp__memory__memory-write"
-
-# --- 5. malformed JSON stdin — hook must not crash ----------------------
-stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-echo "not-valid-json{{{" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-HOOK_RC=$?
-HOOK_STDERR=$(cat "$stderr_file")
-if [[ "$HOOK_RC" -ne 0 ]]; then
-  fail "malformed payload: expected exit 0, got $HOOK_RC stderr: $HOOK_STDERR"
-elif echo "$HOOK_STDERR" | grep -qF "does not write to the graph directly"; then
-  fail "malformed payload: stderr carries deleted-block rejection message: $HOOK_STDERR"
-else
-  pass "malformed payload: exit 0, hook does not crash"
-fi
-
-# --- Summary -----------------------------------------------------------
-echo "---"
-echo "PASSED: $PASS  FAILED: $FAIL"
-[[ "$FAIL" -eq 0 ]] || exit 1
-exit 0

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -1,337 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse hook — enforces agent tool boundaries and approval gating.
-# Usage: pre-tool-use.sh <agent-type>
-# Receives tool call JSON on stdin (from Claude Code hook protocol).
-# Exit 0 = allow, exit 2 = block.
-
-set -uo pipefail
-
-AGENT_TYPE="${1:-public}"
-
-# Source the propagation emitter (Task 560). The library is fail-open;
-# any error path inside it logs to server.log and returns 0, so sourcing
-# never blocks the hook's primary allow/block contract.
-HOOKS_LIB_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)/lib"
-# shellcheck disable=SC1091
-[ -f "$HOOKS_LIB_DIR/hook-emit.sh" ] && source "$HOOKS_LIB_DIR/hook-emit.sh"
-
-# Read stdin — fail closed if unavailable
-if [ -t 0 ]; then
-  # No INPUT yet; propagate with agentId=unknown so the regression is visible.
-  if declare -F hook_emit_decision >/dev/null 2>&1; then
-    hook_emit_decision "unknown" "admin-tool-gate" "?" "block" \
-      "stdin-missing" "Blocked: Cannot determine tool call (no stdin). Failing closed." 2 0
-  fi
-  echo "Blocked: Cannot determine tool call (no stdin). Failing closed." >&2
-  exit 2
-fi
-INPUT=$(cat)
-TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"' -f4)
-
-# Session id for propagation. Empty / parse-failure routes to "unknown" —
-# the propagator emits the record under agentId=unknown rather than dropping.
-SESSION_ID=$(printf '%s' "$INPUT" | python3 -c '
-import sys, json
-try:
-    print(json.load(sys.stdin).get("session_id", "") or "unknown")
-except Exception:
-    print("unknown")
-' 2>/dev/null || echo "unknown")
-
-# ---------------------------------------------------------------------------
-# Admin agent — code directory protection + approval gating
-# ---------------------------------------------------------------------------
-if [ "$AGENT_TYPE" = "admin" ]; then
-
-  # ── Code directory protection ────────────────────────────────────────────
-  case "$TOOL_NAME" in
-    Write|Edit)
-      FILE_PATH=$(echo "$INPUT" | grep -o '"file_path":"[^"]*"' | head -1 | cut -d'"' -f4)
-      case "$FILE_PATH" in
-        # Platform UI source (platform/ui/) — source lives here, not on device
-        */platform/ui/app/*|*/platform/ui/lib/*|*/platform/ui/*.ts|*/platform/ui/*.tsx|*/platform/ui/*.mjs)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "code-dir-protection-ui" \
-            "Blocked: Admin agent cannot modify platform UI source at $FILE_PATH"
-          ;;
-        # Compiled MCP servers, hooks, and scripts — what actually ships to device
-        */platform/plugins/*/mcp/dist/*|*/platform/plugins/*/hooks/*|*/platform/scripts/*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "code-dir-protection-platform" \
-            "Blocked: Admin agent cannot modify platform code at $FILE_PATH"
-          ;;
-        # Entitlement library — verifier source, compiled output, vendored
-        # pubkey, hash file, and any signed entitlement.json. Tampering here is the
-        # agent path to revenue bypass; the legitimate write path is the Rubytech
-        # issuance endpoint, never the agent's filesystem.
-        # Patterns intentionally cover both absolute (*/...) and relative
-        # (no leading slash) paths so an agent can't bypass via cwd-relative writes.
-        */platform/lib/entitlement/*|platform/lib/entitlement/*|*/entitlement.json|entitlement.json)
-          echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=entitlement-file" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "entitlement-file" \
-            "Blocked: Admin agent cannot modify entitlement files at $FILE_PATH. Effective tier and purchasedPlugins derive from a Rubytech-signed payload."
-          ;;
-        # account.json — agent must use the account-update
-        # MCP tool (or plugin-toggle-enabled for enabledPlugins changes), which
-        # whitelists editable fields server-side. Direct Edit/Write bypasses
-        # that whitelist; deny unconditionally including cwd-relative paths.
-        # adds */account.json and *account.json as a backstop so any
-        # layout the named patterns miss is still caught — the Adam Mackay
-        # incident showed a tier upgrade via raw Edit on account.json reach
-        # the disk, exactly the failure mode this hook exists to prevent.
-        */data/accounts/*/account.json|*/config/accounts/*/account.json|data/accounts/*/account.json|config/accounts/*/account.json|*/account.json|*account.json|account.json)
-          echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=account-json" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "account-json" \
-            "Blocked: Admin agent cannot edit account.json directly. Use the account-update or plugin-toggle-enabled MCP tools — they whitelist editable fields server-side and exclude tier and purchasedPlugins by design."
-          ;;
-        # Pending action queue — only the hook and MCP tools may write here
-        */pending-actions/*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "pending-actions" \
-            "Blocked: Admin agent cannot modify pending action files directly"
-          ;;
-      esac
-      ;;
-    Bash)
-      # Block shell commands referencing protected code directories or pending actions
-      case "$INPUT" in
-        *"platform/ui/app/"*|*"platform/ui/lib/"*|*"platform/plugins/"*"hooks/"*|*"platform/scripts/"*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "code-dir-protection-bash" \
-            "Blocked: Admin agent cannot run shell commands against code directories"
-          ;;
-        # Entitlement files via shell — same surface, blocked symmetrically
-        *"platform/lib/entitlement/"*|*"entitlement.json"*)
-          echo "[entitlement] tool-deny: tool=Bash path=entitlement-file field=entitlement-file" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "entitlement-shell" \
-            "Blocked: Admin agent cannot reference entitlement files via shell."
-          ;;
-        # account.json via shell — same rationale as Edit/Write block
-        *"data/accounts/"*"account.json"*|*"config/accounts/"*"account.json"*)
-          echo "[entitlement] tool-deny: tool=Bash path=account-json field=account-json" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "account-json-shell" \
-            "Blocked: Admin agent cannot edit account.json via shell. Use the account-update MCP tool."
-          ;;
-        *"pending-actions/"*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "pending-actions-shell" \
-            "Blocked: Admin agent cannot modify pending action files via shell"
-          ;;
-      esac
-      ;;
-  esac
-
-  # ── Base64 context-overflow guard ─────────────────────────────
-  # Block inline base64 payloads from reaching the model context. Two paths:
-  #
-  #   1. Bash command that ENCODES a binary file to base64/hex (the producer).
-  #   2. Write/Edit content carrying an inline `data:<mime>;base64,…` blob
-  #      (the consumer — agent quoting bytes from a prior tool_result into a
-  #      HTML/markdown Write).
-  #
-  # Either path landed ~33 KB of base64 in the SDK request and the next turn
-  # tripped `main_stream_stalled` at 180 s. The
-  # remediation is symmetric: the agent saves bytes to `$ACCOUNT_DIR/tmp/<sha1>.<ext>`
-  # and references the path (`<img src="./file">` or Read-by-path) instead of
-  # carrying bytes through the assistant turn.
-  #
-  # Parsing uses python3 (already a hook dependency at the action-id site
-  # below); grep on JSON is unsafe for content with escaped quotes or
-  # embedded newlines. Parse failure is fail-open (empty extracted string,
-  # no match, allow) — matches the playwright-file-guard fail-open contract.
-  # Single python3 invocation parses the JSON, runs the tool-specific
-  # regex match (avoiding BSD-vs-GNU grep interval-count incompatibilities —
-  # `grep -E '{4096,}'` errors with "invalid repetition count(s)" on macOS
-  # BSD grep under some pattern combinations), and prints the rejection
-  # outcome to stdout as `REJECT:<reason>:<bytes>` or `ALLOW`. The wrapping
-  # bash logic reads the verdict and emits the rejection log/stderr/exit-2.
-  # Parse failure prints `ALLOW` (fail-open, matching the playwright-file-
-  # guard contract for malformed stdin).
-  GUARD_VERDICT=$(echo "$INPUT" | python3 -c '
-import sys, json, re
-try:
-    d = json.load(sys.stdin)
-    tool = d.get("tool_name", "")
-    ti = d.get("tool_input", {}) or {}
-    if tool in ("Write", "Edit"):
-        # Write.content OR Edit.new_string can carry inline base64.
-        content = ti.get("content") or ti.get("new_string") or ""
-        if not isinstance(content, str):
-            print("ALLOW"); sys.exit(0)
-        # data:<mime>;base64,<≥4096 base64 chars> — threshold matches the
-        # doctrine paragraph in .docs/agents.md. The 4096-char body is
-        # ~3 KB binary, far above any legitimate inline icon.
-        m = re.search(r"data:[^;]+;base64,[A-Za-z0-9+/]{4096,}={0,2}", content)
-        if m:
-            print(f"REJECT:base64-write-content:{len(content)}")
-        else:
-            print("ALLOW")
-    elif tool == "Bash":
-        command = ti.get("command", "")
-        if not isinstance(command, str):
-            print("ALLOW"); sys.exit(0)
-        # Per-segment scan. A compound command like
-        #   cat in.b64 | base64 -d > out.bin; cat photo.png | base64
-        # contains both a legitimate decode AND a malicious encoder. A whole-
-        # command decode-flag check is fooled into allowing the encoder. Split
-        # on shell separators (;, &&, ||, &) and scan each segment as its own
-        # command — the encoder rejection fires when ANY segment is a bare
-        # base64 invocation without a paired decode flag in the SAME segment.
-        # Pipelines (|) keep the segment together because the encoder direction
-        # of `cat file | base64` lives across the pipe.
-        segments = re.split(r";|&&|\|\||(?<![|&])&(?![|&])", command)
-        rejected = None
-        for seg in segments:
-            if re.search(r"(?:^|[\s|;&])xxd[\t ]+-p(?![A-Za-z0-9_-])", seg):
-                rejected = "xxd-plain-hex"; break
-            if re.search(r"(?:^|[\s|;&])base64(?![A-Za-z0-9_-])", seg):
-                if not re.search(r"base64[\t ]+[^|]*(?:-d|-D|--decode)(?![A-Za-z0-9_])", seg):
-                    rejected = "base64-encoder"; break
-        if rejected:
-            print(f"REJECT:{rejected}:{len(command)}")
-        else:
-            print("ALLOW")
-    else:
-        print("ALLOW")
-except Exception:
-    print("ALLOW")
-' 2>/dev/null || echo "ALLOW")
-  case "$GUARD_VERDICT" in
-    REJECT:base64-write-content:*)
-      BYTES="${GUARD_VERDICT##*:}"
-      echo "[pre-tool-use] guard=base64-write-content bytes=${BYTES} action=reject" >&2
-      hook_block_with_emit "$SESSION_ID" "base64-guard" "${TOOL_NAME}" \
-        "base64-write-content" \
-        "Blocked: ${TOOL_NAME} content carries an inline base64 payload (>4 KB encoded). Inline binary in Write.content overloads the model context — the same path produced a main_stream_stalled at ~33 KB on 2026-05-09.
-Save the bytes to \$ACCOUNT_DIR/tmp/<sha1>.<ext> via Bash (e.g. 'base64 -d > out.png'), then reference the file from the document: <img src=\"./<file>\"> or Read-by-path. Do not carry binary bytes through the assistant turn."
-      ;;
-    REJECT:base64-encoder:*|REJECT:xxd-plain-hex:*)
-      REASON="${GUARD_VERDICT#REJECT:}"; REASON="${REASON%:*}"
-      BYTES="${GUARD_VERDICT##*:}"
-      echo "[pre-tool-use] guard=base64-tool-result bytes=${BYTES} tool=Bash reason=${REASON} action=reject" >&2
-      hook_block_with_emit "$SESSION_ID" "base64-guard" "Bash" \
-        "$REASON" \
-        "Blocked: Bash command would emit binary as inline base64/hex to stdout, which lands in the assistant turn and overloads the model context (the 2026-05-09 Rubytech-invoice path hit 66% context after a single ~33 KB tool_result).
-Instead: save the bytes directly to \$ACCOUNT_DIR/tmp/<sha1>.<ext> and operate on the file via path — Read for inspection, <img src=\"./<file>\"> for HTML embedding, the \`file-presentation\` skill for delivery. Decoding base64 (e.g. 'base64 -d in.b64 > out.bin') is allowed."
-      ;;
-    *)
-      : # ALLOW — fall through to approval gating below
-      ;;
-  esac
-
-  # ── Approval gating (EU AI Act Article 14 — human oversight) ─────────────
-  # Strip the mcp__<plugin>__ prefix to get the short tool name.
-  # Built-in tools (no prefix) pass through unchanged.
-  SHORT_NAME=$(echo "$TOOL_NAME" | sed 's/^mcp__[^_]*__//')
-
-  # Derive platform root from this hook's location:
-  #   platform/plugins/admin/hooks/pre-tool-use.sh → platform/
-  HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
-  PLATFORM_ROOT="${HOOK_DIR}/../../.."
-
-  # Resolve the single account directory (Phase 0).
-  ACCOUNTS_DIR="${PLATFORM_ROOT}/../data/accounts"
-  ACCOUNT_DIR=""
-  if [ -d "$ACCOUNTS_DIR" ]; then
-    ACCOUNT_DIR=$(find "$ACCOUNTS_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -1)
-  fi
-
-  # Default require-review tools — matches DEFAULT_REQUIRE_REVIEW in claude-agent.ts
-  DEFAULT_REQUIRE_REVIEW="email-send email-reply whatsapp-send whatsapp-send-document message contact-erase"
-
-  # Check if this tool requires approval review.
-  # 1. Read per-account override from account.json approvalPolicy (if it exists)
-  # 2. Fall back to the default require-review list
-  POLICY=""
-  if [ -n "$ACCOUNT_DIR" ] && [ -f "${ACCOUNT_DIR}/account.json" ]; then
-    # Check per-account override first (grep for the tool name in the approvalPolicy block)
-    OVERRIDE=$(grep -o "\"${SHORT_NAME}\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "${ACCOUNT_DIR}/account.json" 2>/dev/null | head -1 | grep -o '"[^"]*"$' | tr -d '"')
-    if [ -n "$OVERRIDE" ]; then
-      POLICY="$OVERRIDE"
-    fi
-  fi
-
-  # If no per-account override, check the default list
-  if [ -z "$POLICY" ]; then
-    for TOOL in $DEFAULT_REQUIRE_REVIEW; do
-      if [ "$SHORT_NAME" = "$TOOL" ]; then
-        POLICY="require-review"
-        break
-      fi
-    done
-  fi
-
-  # If not in any policy, auto-execute (allow)
-  if [ "$POLICY" != "require-review" ]; then
-    exit 0
-  fi
-
-  # ── Special case: contact-erase preview calls pass through ───────────────
-  # The contact-erase tool has a two-step flow: first call with confirm:false
-  # returns a preview (data counts), second call with confirm:true executes.
-  # Only gate the destructive confirm:true call.
-  if [ "$SHORT_NAME" = "contact-erase" ]; then
-    if ! echo "$INPUT" | grep -q '"confirm"[[:space:]]*:[[:space:]]*true'; then
-      exit 0
-    fi
-  fi
-
-  # ── Queue the action for approval ───────────────────────────────────────
-  PENDING_DIR="${ACCOUNT_DIR}/pending-actions"
-  mkdir -p "$PENDING_DIR" 2>/dev/null
-
-  ACTION_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())' 2>/dev/null || date +%s%N)"
-  CREATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-  # Write atomically: temp file + mv
-  TEMP=$(mktemp "${PENDING_DIR}/.tmp.XXXXXX" 2>/dev/null)
-  if [ -z "$TEMP" ]; then
-    hook_block_with_emit "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-      "approval-queue-mktemp" \
-      "Blocked: Action requires approval but failed to create queue file (disk error). Failing closed."
-  fi
-
-  # The pending action file contains the full hook JSON (tool_name + tool_input)
-  # plus metadata. The MCP approval tools parse it with Node.js JSON.parse.
-  cat > "$TEMP" <<ENDJSON
-{
-  "actionId": "${ACTION_ID}",
-  "toolName": "${SHORT_NAME}",
-  "pluginName": "$(echo "$TOOL_NAME" | sed -n 's/^mcp__\([^_]*\)__.*/\1/p')",
-  "hookPayload": ${INPUT},
-  "state": "pending",
-  "createdAt": "${CREATED_AT}"
-}
-ENDJSON
-
-  if ! mv "$TEMP" "${PENDING_DIR}/${ACTION_ID}.json" 2>/dev/null; then
-    rm -f "$TEMP" 2>/dev/null
-    hook_block_with_emit "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-      "approval-queue-mv" \
-      "Blocked: Action requires approval but failed to queue (filesystem error). Failing closed."
-  fi
-
-  # Record the queued-for-approval block in the propagation buffer; the
-  # readable summary still goes to stdout (CC attaches it as the agent's
-  # tool_result). hook_emit_decision is the no-exit variant — the
-  # subsequent echoes + exit 2 below remain the operator-facing surface.
-  hook_emit_decision "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-    "block" "approval-queued" \
-    "Action ${ACTION_ID} queued for review" 2 0
-
-  # Extract a readable summary of the action for the agent to present
-  # tool_input is the second JSON value in the hook payload
-  echo "Action requires approval before execution."
-  echo ""
-  echo "Action ID: ${ACTION_ID}"
-  echo "Tool: ${SHORT_NAME}"
-  echo "Status: Queued for review"
-  echo ""
-  echo "The admin must approve this action before it can execute."
-  echo "Use action-approve to send, action-reject to cancel, or action-edit to modify."
-  exit 2
-fi